The present invention relates to a security management method for a network having a client and severs, and more particularly, to a network system security management method which integrally manages a user and provides the single sign-on function of utilizing an integrated certificate for the user.
With a widespread use of the Internet, the market trend toward the security management has changed drastically. Especially when a wide area network system such as the Internet and an intra-enterprise network system (intranet) are combined together, the user authentication function and the function of controlling access to resources in the two network systems, by which the two networks can be integrated, have been sought. In other words, the integral management of a user and the centralized management of network resources which cover the two of the wide area network system and intra-enterprise network system have been desired.
As a method of integrally managing a user utilizing a wide area network system, a method as described in, for example, JP-A-6-223041 is known, according to which private information of a utilizer and utilization environment information are ciphered with a private key, a certificate issue server issues, as a certificate, the ciphered information to the utilizer and the utilizer logs in the system by utilizing this certificate. Further, as a security management method considering a distributed system, a method as described in, for example, JP-A-8-106437 is known in which when a user accesses a domain which is not a home domain of the user, a log-on certificate for certificating qualification authentication of the user is utilized. Further, JP-A-7-141296 discloses a system in which a TTP (Trusted Third Party) for managing security over a network domain is provided to perform setting and change of security policy of the overall network and access control based on the security policy is carried out.
Expectantly, the system for performing the user authentication and access control by utilizing the certificate as described above will come into wide use as one of security management systems for future wide area network systems. But when it comes to considering an actual network system, the existing enterprise network system has difficulties in shifting to a working which integrally utilizes a certificate issued by an external certificate authority and shifting to the security management based on the TTP. Namely, a method is desired which introduces a single sign-on scheme based on utilization of a certificate while preserving the existing user authentication scheme based on a user ID and a password.